Sentio Creator Extension Device Manager CVE-2026-80469

User interaction is required - the victim must actively load the malicious device driver package within Sentio Creator Extension Device Manager. No authentication or prior system access is required of the attacker to craft and deliver the package. The attack is contingent on the Device Manager's driver installation workflow being reachable and on the operator being deceived into processing an attacker-supplied package (social engineering or supply-chain substitution). AC:H reflects the need to successfully forge or bypass the JWT-based signature verification mechanism. Exploitation is limited to systems with the Sentio Creator Extension Device Manager installed, which is specific to SICK industrial device management workflows. There is no indication of exploitation against default configurations without the application being present and in active use.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) scores 8.3 and reflects a network-reachable, unauthenticated attack of elevated complexity requiring user interaction and achieving full scope-changed impact (kernel/OS level via driver). Real-world risk is meaningful in industrial environments where operators routinely load driver packages from suppliers - social engineering a user into installing a spoofed SICK driver package is a plausible and targeted attack. AC:H appropriately captures the need to bypass the cryptographic verification mechanism, which is non-trivial but achievable via known JWT attack patterns. The scope change (S:C) is material: device drivers execute in kernel space and their compromise extends well beyond the Device Manager application. No KEV listing and no disclosed POC reduce urgency for opportunistic exploitation, but targeted supply-chain-style attacks against industrial facilities are well-precedented. EPSS data was not provided. The product is niche ICS tooling, limiting attack surface to a narrow but operationally critical audience.

An attacker targeting an industrial facility crafts a malicious device driver package and forges the JWT-based package signature by exploiting the verification bypass (e.g., algorithm confusion against a known SICK public key). The package is delivered to an operator via a spear-phishing email or a compromised update channel posing as a legitimate SICK driver update. When the operator loads the package in Sentio Creator Extension Device Manager, the malicious driver installs and executes attacker-controlled code with OS/kernel-level privileges on the engineering workstation. No public POC has been identified, but JWT signature bypass techniques are widely documented.